CVE-2026-14647: ONNX Runtime Out-of-Bounds Read Vulnerability in Shape Inference

Technical summary

CVE-2026-14647 is an out-of-bounds read vulnerability in the convPoolShapeInference_opset19 function within onnx/defs/nn/old.cc in ONNX Runtime up to version 1.21.x. The flaw occurs during shape inference processing for convolutional and pooling operations (ONNX opset 19). When malformed model metadata is provided, the function reads memory outside allocated buffer boundaries, violating memory safety constraints. The weakness is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read), both fundamental memory safety issues. Successful exploitation requires network access and valid authentication credentials.

Business impact

Organizations using ONNX Runtime in production environments face confidentiality risk, as authenticated attackers could extract sensitive model parameters, training data, or system memory contents. The impact is limited by the requirement for valid credentials and the read-only nature of the vulnerability—no data modification or denial of service occurs. However, in scenarios where ONNX Runtime processes confidential models or where compromised user accounts exist, this could enable intellectual property theft or information disclosure. The vulnerability is most critical for organizations exposing ONNX Runtime inference services to untrusted internal users or partner networks.

Affected systems

ONNX Runtime versions up to and including 1.21.x are vulnerable. The affected component is the shape inference engine used during model loading and validation. Any deployment consuming untrusted or user-supplied ONNX models is at risk. This includes ML inference services, automated model pipelines, and cloud-hosted ML platforms built on ONNX Runtime. Organizations should inventory all deployments of ONNX Runtime, particularly those accepting external model inputs or serving multiple tenants.

Exploitability

Exploitation requires network access and valid authentication credentials, reducing the attack surface compared to unauthenticated flaws. An attacker must craft a malicious ONNX model file with specific metadata that triggers incorrect buffer calculations during shape inference. Public exploit code is available, lowering the bar for would-be attackers but not providing weaponized remote execution capabilities. The CVSS score of 4.3 (Medium) reflects the authentication requirement and confidentiality-only impact. Real-world exploitation likelihood is moderate—dependent on whether attackers have compromised credentials and whether models are processed without additional sandboxing.

Remediation

Apply the patch identified as commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 to remediate this vulnerability. Organizations should verify this patch has been integrated into an official ONNX Runtime release and test compatibility with their inference workloads before production deployment. Until patching is possible, restrict ONNX model ingestion to trusted sources, implement input validation on model files, and consider running ONNX Runtime in isolated processes with minimal privilege. Monitor authentication logs for unusual model upload or inference activity.

Patch guidance

Verify the availability of a patched ONNX Runtime release incorporating commit a7bf3a0f1d18bb62575236ef6e4944980c40e045. Check the official ONNX Runtime repository and release notes to confirm which version contains this fix. After upgrading, conduct regression testing on model inference accuracy and performance to ensure the patch does not affect functionality. If using ONNX Runtime through a third-party integration (cloud ML services, PyTorch, TensorFlow interop), verify that the upstream provider has released a patched version before upgrading. Deploy patches to development and staging environments first, then roll out to production using your standard change management process.

Detection guidance

Monitor ONNX Runtime process behavior for abnormal memory access patterns or crashes during model loading—out-of-bounds reads may cause segmentation faults or access violations visible in system logs. Review model upload and inference request logs for suspicious metadata or unusual model architectures targeting opset 19 pooling operations. Implement intrusion detection signatures to flag model files with malformed shape tensors or unexpected convolution/pooling configurations. Use memory safety tools (AddressSanitizer, Valgrind) in test environments to surface out-of-bounds reads during model validation. Track patch deployment status across all ONNX Runtime instances to ensure no unpatched versions remain in production.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS score of 4.3 reflects the authentication requirement and read-only impact, positioning it as medium priority. However, if your organization processes untrusted ONNX models, accepts model uploads from external users, or operates multi-tenant ML inference services, prioritize patching within 30 days. If ONNX Runtime instances only consume internally authored, static models in isolated environments, remediation can be scheduled within normal patch cycles (60–90 days). Public availability of exploit code elevates risk for less-mature security teams and increases the likelihood of opportunistic exploitation against unpatched systems.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium severity) accurately reflects the threat profile. The network attack vector (AV:N) and low complexity (AC:L) indicate broad reachability; however, the requirement for valid authentication (PR:L) significantly restricts the attacker pool. The impact is limited to confidentiality (C:L) with no integrity or availability compromise (I:N, A:N), as out-of-bounds reads cannot modify data or crash services reliably. The unchanged scope (S:U) means exploitation does not bypass security boundaries. Organizations with strong credential hygiene and restricted model ingestion may view their actual risk as sub-medium; conversely, those with weak identity controls or open model pipelines should treat this as higher-priority.

Frequently asked questions